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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN RE APPLICATION OF USA 
PURSUANT TO 18 U.S.C. 3512 FOR 
SEARCH OF INFORMATION 
ASSOCIATED WITH ONE FACEBOOK 
PROFILE STORED AT PREMISES 
CONTROLLED BY FACEBOOK INC. 


ML No. 


Reference: DOJ Ref # CRM-182-58237; Subject Account: 100006156197762 

AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Cynthia Kayle, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant for 
information associated with a certain Facebook profile (“the account”) that is stored at premises 
owned, maintained, controlled, or operated by Facebook, Inc. (“Facebook”), a social networking 
company headquartered in Menlo Park, California. The information to be searched is described 
in the following paragraphs and in Attachment A. This affidavit is made in support of an 
application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), 2703(c)(1)(A), and 
35 12(a), to require Facebook to disclose to the government copies of the information (including 
the content of communications) further described in Section I of Attachment B. Upon receipt of 
the information described in Section I of Attachment B, government-authorized persons will 
review that information to locate the items described in Section II of Attachment B, using the 
procedures described in Section III of Attachment B. 

2. The information requested in this search warrant is being sought pursuant to a 
request for assistance (“the request”) from the Federal Office of Justice of the Federal Republic 
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of Germany (“Germany”) transmitted to the United States Department of Justice dated January 
17, 2018. Authorities in Germany are investigating terrorism and war crimes offenses in 
violation of the criminal laws of Germany, specifically, sections 52, 53, 129a, 129b, and 211 of 
the German Criminal Code and section 8 of the German Code of Crimes against International 
Law. Copies of the applicable laws are appended to this affidavit. 

3. The request is made pursuant to the Treaty Between the United States of America 
and the Federal Republic of Germany on Mutual Legal Assistance in Criminal Matters, U.S.- 
F.R.G., Oct. 14, 2003, S. TREATY DOC. NO. 108-27 (2004), as supplemented by the 
Supplementary Treaty to the Treaty Between the United States of America and the Federal 
Republic of Germany on Mutual Legal Assistance in Criminal Matters, F.R.G.-U.S., April 18, 
2006, S. TREATY DOC. NO. 109-13 (2006) (hereinafter, the “Treaty”). Under the Treaty, the 
United States is obligated to render assistance in response to this Request. 

4. I am a Special Agent with the Federal Bureau of Investigation, and have been so 
employed since 2005. 1 am currently assigned to the International Operations Division, Mutual 
Legal Assistance Treaty Unit. My current duties include responding to requests from foreign 
governments pursuant to Mutual Legal Assistance Treaties, including serving as the affiant on 
search warrant affidavits, serving search warrants, and reviewing the data received for relevance 
in compliance with the parameters of the search warrants. 

5. Prior to my assignment in the International Operations Division, I was assigned to 
the Los Angeles Division, Orange County Resident Agency, as a member of the Child 
Exploitation Task Force (“CETF”). The CETF is responsible for investigating federal criminal 
statutes in the Central District of California involving the sexual exploitation of children under 
18 U.S.C. §§ 2251 et seq. In addition, I have participated in numerous investigations including, 
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but not limited to, the investigations of crimes against children, violent crimes, cybercrimes, 
white collar crimes, and national security investigations. 

6. . The facts set forth in this affidavit are based upon information conveyed to the 
United States via the request made pursuant to the Treaty by authorities in Germany and upon 
my training and experience. This affidavit is intended to show merely that there is sufficient 
probable cause for the requested warrant and does not set forth all of my knowledge about this 
matter. 

7. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that violations of the criminal laws of Germany have been 
committed by Abdul Jawad A1 Khalaf (“Al Khalaf'). There is also probable cause to search the 
information described in Attachment A for evidence, instrumentalities, contraband or fruits of 
these crimes further described in Attachment B. 

JURISDICTION 

8. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. §2711. See 18 U.S.C. § 2703(a), (b)(1)(A) & 
(c)(1)(A). Specifically, the Court “is acting on a request for foreign assistance pursuant to 

[18 U.S.C.] section 3512 .. . .” 18 U.S.C. § 271 l(3)(A)(iii); see also 18 U.S.C. § 3512(a)(2)(B) 
(court may issue “a warrant or order for contents of stored wire or electronic communications or 
for records related thereto, as provided under section 2703”), § 3512(c)(3) (“application for 
execution of a request from a foreign authority under this section may be filed ... in the District 
of Columbia”). 

9. This application to execute the Request has been approved and duly authorized by 
an appropriate official of the Department of Justice, through the Office of International Affairs 
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(“01 A”). 1 See 18 U.S.C. § 3512(a). An 01A attorney has reviewed the request, confirmed that it 
was submitted by authorities in Germany in connection with a criminal prosecution, and 
authorized the undersigned to file this application. 

PROBABLE CAUSE 

10. Authorities in Gennany are prosecuting A1 Khalaf and others for their role in the 
execution of thirty-six prisoners in Syria in or around March 2013. The German investigation of 
A1 Khalaf first began in February 2016, when Saleh Alghadban (“Alghadban”) turned himself in 
to French police and confessed to being an Islamic State of Iraq and Syria (“ISIS”) terrorist. 
Specifically, Alghadban claimed to be in charge of a terrorist cell tasked with carrying out an 
attack in Diisseldorf and named A1 Khalaf as one of his accomplices. According to Alghadban, 
while in Syria, Al Khalaf had led his own combat unit in Syria named “Katiba Mohamed Ibn 
Abd Allah” (“Katiba”), which was a subunit of the foreign terrorist organization Jabhat al-Nusra 
(“the Nusra Front”). 

11. Separately, an individual named Alhaz sought asylum in Germany. On August 
30, 2016, during his asylum hearing, Alhaz identified himself as a member of Al Khalaf s 
combat unit named Katiba. Alhaz detailed the structure, finances, armament, and activities of 
Katiba Mohamed Ibn Abd Allah, identified former members of this unit, and gave an account of 
his own actions for Katiba, for which he was arrested on December 20, 2016. Alhaz further 
noted that Al Khalaf was frequently referred to by his battle name “Abu Jandal.” 


1 The Attorney General, through regulations and Department of Justice directives, has delegated to the 
Office of International Affairs the authority to serve as the "Central Authority” under treaties and 
executive agreements between the United States and other countries pertaining to mutual assistance in 
criminal matters. See 28 C.F.R. §§ 0.64-1,0.64-4, and Appendix to Subpart K, Directive Nos. 81B and 
81C (2018). 
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12. German authorities subsequently questioned a number of close acquaintances of 
A1 Khalaf. One of those acquaintances led German authorities to a witness then residing in the 
Netherlands and whose identity is being kept secret (“Witness 1”). The acquaintance reported 
that he and A1 Khalaf had visited Witness 1 in 2014 because the visit was important to A1 
Khalaf. As part of their investigation into A1 Khalaf s ties to ISIS and the Nusra Front, German 
authorities submitted a letter rogatory to Dutch authorities seeking assistance in locating and 
interviewing Witness 1. With the assistance of Dutch authorities, German authorities 
interviewed Witness 1 on February 9, 2017. During this interview, Witness 1 provided 
authorities with a detailed account of a mass execution in which A1 Khalaf allegedly took part in 
Syria in March 2013. Based on this information, German authorities shifted the focus of their 
investigation to A1 Khalaf s role in murder and war crimes offenses. 

The 2013 Mass Execution 

13. The events described below are mainly based on testimony from the cooperating 
defendant Alhaz and Witness 1 as well as publicly available videos connected to the event. 

14. In March 2013, A1 Khalaf s Katiba combat unit had formed a temporary alliance 
with two other combat units, and together these allied units took part in the capture of the 
governor’s palace in Raqqa, Syria. Following the Raqqa attack, the Nusra Front forces captured 
Syrian government employees, including police officers, security staff, border guards, and 
members of the army and militiamen. Thirty-six of these prisoners were handed over to A1 
Khalaf s combat unit and its allies. 

15. At the time of the attack, Witness 1 was serving as the head of the media 
department in the nearby Syrian town of Tabqa. Witness 1 recalled to authorities that in March 
or April 2013, an unidentified individual contacted Witness 1 at around 5:00 a.m. and demanded 
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that Witness 1 come film something. Witness 1 was taken to a garbage dump outside of town 
where he saw a group of people gagged and guarded by armed fighters. Although he was 
ordered to film their execution, Witness 1 refused to do so. However, because he had been 
driven to the site, he was unable to leave. Consequently, Witness 1 subsequently bore witness to 
the executions of the prisoners held by A1 Khalafs combat unit. Witness 1 described how the 
prisoners were first taken before a Nusra Front Sharia judge named “Abu Turaba” who was 
responsible for the Tabqa area; Abu Turaba ordered that the prisoners be executed. The 
prisoners were then taken in groups of five or six to a natural hollow where they were executed. 
Abu Turaba personally killed the first captive with a stone. Witness 1 testified that A1 Khalaf, 
also known to Witness 1 as Abu Jandal, then encouraged his fighters to kill the other prisoners, 
which they did using automatic rifles, pistols, and knives. According to Witness 1, A1 Khalaf 
personally killed several prisoners using all three types of weapons. 

16. German authorities subsequently located a video on YouTube entitled “36 
Regime Prisoners in the Governor’s Palace in Al-Raqqa 7-3-2013.” The video bears a time 
stamp of March 7, 2013. In the video, an armed man reports that thirty-six prisoners were taken 
from the governor’s palace in Raqqa by combat forces including the “Katiba Mohamed Ibn Abd 
Allah under the command of Sheikh Abu Jandal.” Witness 1, Alhaz, AI Khalafs former 
roommates, and one of Al Khalafs brothers each confirmed that Abu Jandal is Al Khalafs battle 
name. The video then shows thirty-six men grouped together on their knees. 

17. German authorities subsequently indicted Al Khalaf and others for their roles in 
this event and have commenced their criminal trial, which is anticipated to last until the fall of 
2018. So far, Witness 1 has provided four full days of testimony before the Stuttgart Higher 
Regional Court, in which he confirmed his initial statement in almost every detail and provided 
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further information. When shown the video in court, Witness 1 was able to identify some of the 
prisoners shown on the video as those that he had seen killed 

Facebook Evidence of the March 2013 Killings 

18. At trial, Witness 1 also testified to a Facebook exchange he had with A1 Khalaf in 
which A1 Khalaf allegedly admitted to his role in the killing of the prisoners. Specifically, after 
moving to the Netherlands, Witness 1 used a Facebook profile associated with user-ID 
100006156197762. Witness 1 testified that between approximately September and October of 
2014, he had exchanged Facebook messages with A1 Khalaf regarding the March 2013 slaughter 
of prisoners. According to Witness 1, during this exchange, A1 Khalaf admitted to participating 
in the execution. Shortly after this conversation, in late October 2014, Witness 1 testified that A1 
Khalaf visited him. At that time, A1 Khalaf demanded that Witness 1 delete the Facebook 
communications and threatened that if Witness 1 did not delete the messages, A1 Khalaf would 
seek revenge on Witness 1 and his family. This testimony was partially corroborated by the 
acquaintance who had first led German authorities to Witness 1. That acquaintance confirmed to 
authorities that he had traveled with A1 Khalaf to visit Witness 1 in late October 2014. 

19. Sometime not long after the Facebook exchange with A1 Khalaf, Witness 1 
stopped using his Facebook account. When Witness 1 attempted to provide authorities access to 
his Facebook account in 2017, Witness 1 and authorities learned that Facebook had blocked the 
account. Consequently, neither Witness 1 nor authorities have been able to access the records, 
for which Facebook requires legal process. 

20. German authorities are now seeking content records for the Facebook profile 
100006156197762 to corroborate Witness l’s testimony and establish A1 Khalaf s confession to 
his involvement in murder and war crimes. 
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BACKGROUND CONCERNING FACEBOOK 

1. Facebook owns and operates a free-access social networking website of the same 
name that can be accessed at http://www.facebook.com. The website was launched on February 
4, 2004 and is owned and operated by Facebook, Inc. Facebook allows its users to establish 
accounts with Facebook, and users can then use their accounts to share written news, 
photographs, videos, and other information with other Facebook users, and sometimes with the 
general public. 

2. Facebook asks users to provide basic contact and personal identifying information 
to Facebook, either during the registration process or thereafter. This information may include 
the user’s full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook 
security questions and answers (for password retrieval), physical address (including city, state, 
and zip code), telephone numbers, screen names, websites, and other personal 

identifiers. Facebook also assigns a user identification number to each account. Facebook 
identifies unique Facebook accounts by a user’s e-mail address, the user-identification number, 
or the username associated with a Facebook profile. 

3. Facebook users may join one or more groups or networks to connect and interact 
with other users who are members of the same group or network. Facebook assigns a group 
identification number to each group. A Facebook user can also connect directly with individual 
Facebook users by sending each user a “Friend Request.” If the recipient of a “Friend Request” 
accepts the request, then the two users will become “Friends” for purposes of Facebook and can 
exchange communications or view information about each other. Each Facebook user’s account 
includes a list of that user’s “Friends” and a “News Feed,” which highlights information about 
the user’s “Friends,” such as profile changes, upcoming events, and birthdays. 
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4. Facebook users can select different levels of privacy for the communications and 
information associated with their Facebook accounts. By adjusting these privacy settings, a 
Facebook user can make information available only to himself or herself, to particular Facebook 
users, or to anyone with access to the Internet, including people who are not Facebook users. A 
Facebook user can also create “lists” of Facebook friends to facilitate the application of these 
privacy settings. Facebook accounts also include other account settings that users can adjust to 
control, for example, the types of notifications they receive from Facebook. 

5. Facebook users can create profiles that include photographs, lists of personal 
interests, and other information. Facebook users can also post “status” updates about their 
whereabouts and actions, as well as links to videos, photographs, articles, and other items 
available elsewhere on the Internet. Facebook users can also post information about upcoming 
“events,” such as social occasions, by listing the event’s time, location, host, and guest list. In 
addition, Facebook users can “check in” to particular locations or add their geographic locations 
to their Facebook posts, thereby revealing their geographic locations at particular dates and 
times. A particular user’s profile page also includes a “Wall,” which is a space where the user 
and his or her “Friends” can post messages, attachments, and links that will typically be visible 
to anyone who can view the user’s profile. 

6. Facebook allows users to upload photos and videos, which may include any 
metadata such as location that the user transmitted when s/he uploaded the photo or video. It 
also provides users the ability to “tag” (i.e., label) other Facebook users in a photo or 

video. When a user is tagged in a photo or video, he or she receives a notification of the tag and 
a link to see the photo or video. For Facebook’s purposes, the photos and videos associated with 
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a user’s account will include all photos and videos uploaded by that user that have not been 
deleted, as well as all photos and videos uploaded by any user that have that user tagged in them. 

7. Facebook users can exchange private messages on Facebook with other 

users. Those messages are stored by Facebook unless deleted by the user. Facebook users can 
also post comments on the Facebook profiles of other users or on their own profiles; such 
comments are typically associated with a specific posting or item on the profile. In addition, 
Facebook has a chat feature that allows users to send and receive instant messages through 
Facebook Messenger. These chat communications are stored in the chat history for the 
account. Facebook also has Video and Voice Calling features, and although Facebook does not 
record the calls themselves, it does keep records of the date of each call. 

8. If a Facebook user does not want to interact with another user on Facebook, the 
first user can “block” the second user from seeing his or her account. 

9. Facebook has a “like” feature that allows users to give positive feedback or 
connect to particular pages. Facebook users can “like” Facebook posts or updates, as well as 
webpages or content on third-party (i.e., non-Facebook) websites. Facebook users can also 
become “fans” of particular Facebook pages. 

10. Facebook has a search function that enables its users to search Facebook for 
keywords, usernames, or pages, among other things. 

11. Each Facebook account has an activity log, which is a list of the user’s posts and 
other Facebook activities from the inception of the account to the present. The activity log 
includes stories and photos that the user has been tagged in. as well as connections made through 
the account, such as “liking” a Facebook page or adding someone as a friend. The activity log is 
visible to the user but cannot be viewed by people who visit the user’s Facebook page. 


10 



Case 1:18-m1-00446-RMM Document 1-1 Filed 06/22/18 Page 11 of 15 


12. Facebook also has a Marketplace feature, which allows users to post free 
classified ads. Users can post items for sale, housing, jobs, and other items on the Marketplace. 

13. In addition to the applications described above, Facebook also provides its users 
with access to thousands of other applications (“apps”) on the Facebook platform. When a 
Facebook user accesses or uses one of these applications, an update about that the user's access 
or use of that application may appear on the user’s profile page. 

14. Facebook also retains Internet Protocol (“IP”) logs for a given user ID or IP 
address. These logs may contain information about the actions taken by the user ID or IP 
address on Facebook, including information about the type of action, the date and time of the 
action, and the user ID and IP address associated with the action. For example, if a user views a 
Facebook profile, that user's IP log would reflect the fact that the user viewed the profile, and 
would show when and from what IP address the user did so. 

15. Social networking providers like Facebook typically retain additional information 
about their users' accounts, such as information about the length of service (including start date), 
the types of service utilized, and the means and source of any payments associated with the 
service (including any credit card or bank account number). In some cases, Facebook users may 
communicate directly with Facebook about issues relating to their accounts, such as technical 
problems, billing inquiries, or complaints from other users. Social networking providers like 
Facebook typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. 

16. As explained herein, information stored in connection with a Facebook account 
may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal 
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conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Facebook user’s IP log, stored electronic communications, and other data retained by Facebook, 
can indicate who has used or controlled the Facebook account. This ‘‘user attribution” evidence 
is analogous to the search for “indicia of occupancy” while executing a search warrant at a 
residence. For example, profile contact information, private messaging logs, status updates, and 
tagged photos (and the data associated with the foregoing, such as date and time) may be 
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook 
account activity can show how and when the account was accessed or used. For example, as 
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access 
their accounts along with the time and date. By determining the physical location associated 
with the logged IP addresses, investigators can understand the chronological and geographic 
context of the account access and use relating to the crime under investigation. Such information 
allows investigators to understand the geographic and chronological context of Facebook access, 
use, and events relating to the crime under investigation. Additionally, Facebook builds geo¬ 
location into some of its services. Geo-location allows, for example, users to “tag” their location 
in posts and Facebook “friends” to locate each other. This geographic and timeline information 
may tend to either inculpate or exculpate the Facebook account owner. Last, Facebook account 
activity may provide relevant insight into the Facebook account owner’s state of mind as it 
relates to the offense under investigation. For example, information on the Facebook account 
may indicate the owner’s motive and intent to commit a crime (e.g., information indicating a 
plan to commit a crime), or consciousness of guilt (e.g., deleting account information in an effort 
to conceal evidence from law enforcement). 
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17. Therefore, the computers of Facebook are likely to contain all the material 
described above, including stored electronic communications and information concerning 
subscribers and their use of Facebook, such as account access information, transaction 
information, and other account information. 

CONCLUSION 

18. Based on the forgoing, 1 request that the Court issue the proposed search warrant. 

19. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

20. Because the warrant will be served on Facebook, Inc. who will then compile the 
requested records and information at a time convenient to it, there exists reasonable cause to 
permit the execution of the requested warrant at any time in the day or night. 

Respectfully submitted, 


Cynthia Kayle 
Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me on 


,201 


UNITED STATES MAGISTRATE JUDGE 
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Relevant Provisions of Germany’s Criminal Code 

Section 129a - Forming terrorist organizations 

(1) Whoever forms an organization, the objectives or activity of which are directed towards 
the commission of: 

1. murder with aggravating circumstances (Section 211) or manslaughter (Section 
212) ... or war crimes (Section 8 ... of the Code of Crimes against International 
Law) 

2. [. . .] or whoever participates in such a group as a member 
shall be punished with imprisonment from one year to ten years. 

(2-9) [...] 

Section 129b - Criminal and terrorist organizations abroad; extended confiscation and 

deprivation 

(1) Section 129 and section 129a shall apply to organizations abroad. If the offence relates to 
an organization outside the member states of the European Union, this shall not apply 
unless the offence was committed by way of an activity exercised within the Federal 
Republic of Germany or if the offender or the victim is a German or is found within 
Germany. In cases which fall under the 2nd sentence above, the offence shall only be 
prosecuted on authorization by the Federal Ministry of Justice. Authorization may be 
granted for an individual case or in general for the prosecution of future offences relating 
to a specific organization. [. . .] 

( 2 ) [■ • ■] 

Section 211 - Murder with aggravating circumstances 

(1) The murderer shall be punished with imprisonment for life. 

(2) A murderer is whoever kills a human being out of murderous lust, to satisfy his sexual 
desires, from greed or otherwise base motives, treacherously or cruelly or with means 
dangerous to the public or in order to make another crime possible or cover it up. 

Section 52 - Act Constituting More than One Violation 

(1) If the same act violates more than one penal norm or the same penal norm repeatedly, 
then only one punishment shall be imposed. 

(2) If more than one penal norm has been violated, then the punishment shall be determined 
according to the norm that provides for the most severe punishment. It may not be more 
lenient that the other applicable norms permit. 

(3-4) [. . .] 

Section 53 - Commission of More than One Violation - 

(1) If someone has committed more than one crime, as to which judgment will be 

simultaneously rendered, and incurred more than one term of imprisonment or more than 
one fine, an aggregate punishment shall be imposed. 

(2-3) [...] 



Case 1:18-m 1-00446-RMM Document 1-1 Filed 06/22/18 Page 15 of 15 


Relevant Provisions of Germany’s Code of Crimes against International Law 


Section 8 - War crimes against persons 

(1) Whoever in connection with an international armed conflict or with an armed conflict not 
of an international character: 

1. kills a person who is to be protected under international humanitarian law, 

2 - 6 . [.. .] 

7. imposes on, or executes a substantial sentence in respect of a person who is to 
be protected under international humanitarian law, in particular the death penalty 
or imprisonment, without that person having been sentenced in a fair and regular 
trial affording the legal guarantees required by international law, 

8-9. [. . .] shall be punished, in the cases referred to under number 1, with 
imprisonment for life, ... in the cases referred to under 6 to 8, with imprisonment 
for not less than two years. 

(2-5) [. . .] 

(6) Persons who are to be protected under international humanitarian law shall be: 

1 - 2 . [. • -] 

3. in an international armed conflict and in an armed conflict not of an 
international character: members of armed forces and combatants of the adverse 
party, both of whom have laid down their arms or have no other means of defense 
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